Living Off Trusted Sites: Zoom service abuse to deliver credential phishing attack · Blog · Sublime Security

This report describes a credential-phishing campaign that abused Zoom Events and Zoom Docs to host a man-in-the-middle phishing page impersonating Microsoft 365 (using a malicious office.regencyoutdor.com link). The attack leverages living-off-the-trusted-sites techniques to appear legitimate and aims to steal user credentials; Sublime's AI detection flagged and prevented the attack while highlighting suspicious sender metadata, vague language, and mismatched hostnames.